Chain Reaction: The Insanity of L1 Bridges (Cross-Chain Chaos)

The Wormhole hack at about $320M could be classified as a counterfeit operation and a bank robbery at the same time. This makes it both the most successful counterfeiting operation in history and the second-largest bank robbery ever. A brilliant forensic reverse engineering job of the hack published on Twitter by @samczsun highlights both the technical complexities of L1 Bridges (systems that can transport value between different Layer 1 blockchains) and the current lack of technical and economic security standards. The type of code exploit used is not confined to L1 bridges, by the way, but could happen in DeFi protocols as well that employ similar authentication methods. The kicker is that the bug fix of the hack was available on a public code repository for two weeks prior to the hack. This may well have been what alerted the hacker to the exploit. Good vulnerability response processes keep things under wrap until the vulnerability is fixed, and only then made public.

However, with billions locked up in L1 bridges, and increased demand, the question is, are L1 bridges creating the crypto equivalent of the mortgage-backed securities crisis of 2008?

The short answer is yes! The Bridges industry is simply not yet sophisticated enough to deal with that much value, and, therefore, that much risk. This is like a lower league team suddenly competing in the UEFA Champions League without the proper players and resources, also known as a pre-programmed disaster! Vitalik Buterin gave great and simple reasons in a recent Reddit thread about the systemic risks of L1 bridges.

As L1 bridges are quickly locking more value, the risk is increasing rapidly, and becoming systemic. Here is a simple example: I take out an overcollateralized loan on say an Aave loan pool using bridged tokens such as WSOL or WADA or WBTC as collateral. What if the WADA is actually W-WADA coming from Solana, and WBTC is W-WBTC coming from Cardano? That means the lender must not only trust the security of the original Cardano, Solana, Ethereum, and Bitcoin Layer 1 networks. The lender must also trust the security of five different bridge operator networks with significantly fewer validators than the L1 networks, and in some cases complex, unaudited code. In addition, the lender must trust that the funds were not illegally minted on some bridge, which would make the loan actually undercollateralized.

This is comparable to the mortgage-backed securities crisis where everybody ASSUMED the prices would continue to go up, everybody ASSUMED loans were not given to financially unsophisticated people, everybody ASSUMED default rates would not increase significantly, despite low teaser rates on NINJA loans resetting after a year or two. And we know what happened then.

The writing is on the wall in the crypto community as well … unless L1 bridge networks grow up, listen to the adults in the room, and follow interoperability specifications and security guidelines as published by standards bodies such as the Enterprise Ethereum Alliance Interop Working Group, which always welcomes new contributors to improve cross-chain security.

Until then … Bridger beware!

Stay up to date on everything EEA by following us on Twitter, LinkedIn and Facebook.